dc626f8f3b32c1e751d02c3e881bdfdc701a8db9dcb11a424b68f69fd7c4ce5c

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 14:34

Target

DevolucionImpuestopiendenteTGR_b1Gz5R2UBS.cmd
Size

3KB
MD5

437232fabe2b83b0d67647378088bc64
SHA1

7fd0ce07fe455f483d9714322f08e9f9c860aa4f
SHA256

1e74435045984691a9d8bce58101b8e3509c1031142b8aedd8f81d1c67eedbd2
SHA512

d975f69eca32d23781408118c66a3b8bd2a6c4006eca6ea78a7ef37f7d6cb7a88422e446ebf58e650f7e84ab7fbbcd299c7cc8ba3fb68d5a0daefeb141912f3d

Score

8^/10

Blocklisted process makes network request 3 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ipinfo.io

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2660	2252	cmd.exe	31
PID 2252 wrote to memory of 2660	2252	cmd.exe	31
PID 2252 wrote to memory of 2660	2252	cmd.exe	31
PID 2252 wrote to memory of 2708	2252	cmd.exe	32
PID 2252 wrote to memory of 2708	2252	cmd.exe	32
PID 2252 wrote to memory of 2708	2252	cmd.exe	32
PID 2708 wrote to memory of 2772	2708	cmd.exe	33
PID 2708 wrote to memory of 2772	2708	cmd.exe	33
PID 2708 wrote to memory of 2772	2708	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DevolucionImpuestopiendenteTGR_b1Gz5R2UBS.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo %UGv0IQM7FHm6d8Ok36% "
  2⤵
  PID:2660
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell.exe -exec bypass -nop -win 1 -
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -exec bypass -nop -win 1 -
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2772

memory/2772-4-0x000007FEF646E000-0x000007FEF646F000-memory.dmp

Filesize
4KB

Download
memory/2772-5-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2772-6-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/2772-7-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-9-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-8-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-10-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-12-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download